• Contractor payments data matching program protocol

    1 Data matching guidelines

    The Australian Taxation Office (ATO) is committed to voluntarily comply with the Guidelines on data matching in Australian government administration (2014) (Guidelines) published by the Office of the Australian Information Commissioner (OAIC).

    The contractor payments data matching program protocol is prepared and published in accordance with these guidelines.

    2 Overview

    The ATO routinely collects data on payments made to contractors by businesses as part of our employer obligations compliance activities.

    Contractors can be either individuals, partnerships or other types of entities. Contractors earn income by providing services to other businesses and are generally paid upon production of an invoice by the contractor.

    The data collected from businesses is used to identify contractors that may not be meeting their taxation obligations by registering correctly with the ATO or reporting the payments they are receiving. The data is also analysed to detect trends and compliance issues enabling the ATO to develop and deliver educational products and tailored services.

    This is an on-going data matching program.

    3 Purpose and objectives

    3.1 Purpose

    The purpose of this data matching program is to ensure that contractors are correctly meeting their taxation obligations in relation to payments they receive. These obligations include registration, lodgment, reporting and payment responsibilities.

    3.2 Objectives

    Objectives of the contractor payments data matching program:

    • Promote voluntary compliance and strengthen community confidence in the integrity of the tax system
    • Identify and address contractors that may not be meeting their taxation obligations, including registration, lodgment and reporting
    • Verify the integrity of the information held on the Australian Business Register to assist the Registrar develop educational and compliance strategies
    • Obtain intelligence to identify risks and trends about contractors that may not be complying with their taxation obligations
    • Better tailor educational products and services to address identified areas of concern and give more certainty to taxpayers in managing their obligations.

    The ATO is seeking to obtain external data to cross-reference with its own internal data to identify relevant cases for administrative action, including compliance and educational strategies.

    4 Agencies and entities involved

    4.1 Matching and primary user agency

    The ATO is the matching agency and will generally be the sole user of the data. In limited and specific circumstances as contained in Division 355 of Schedule 1 to the Taxation Administration Act 1953, the ATO may provide individual records to other agencies, including state and territory revenue authorities and law enforcement agencies.

    The data matching program will be conducted using the ATO’s secure computer systems and in accordance with approved policies and procedures.

    4.2 Source entities

    Data will be obtained from businesses that are subject to compliance activities conducted by the employer obligations area within the ATO. Data may also be collected from other businesses associated with the primary businesses.

    The secrecy and confidentiality provisions of the Taxation Administration Act 1953 specifically preclude the ATO from disclosing which businesses are or will be subject to these compliance actions.

    The ATO advises the businesses subject to this action to update their privacy policies to note that personal information may be disclosed to the ATO for data matching purposes in accordance with guideline 5.9.

    5 Data issues

    5.1 Data elements

    The ATO will obtain the following data elements from the source entities for the 2013-14, 2014-15 and 2015-16 financial years:

    • Australian Business Number (ABN) of the payer business
    • ABN of the payee business (contractor)
    • Name of the contractor
    • Address of the contractor
    • Telephone details of the contractor
    • Dates of payments to the contractor
    • Amounts paid to the contractor (including details of whether the payment included GST).

    5.2 Number of records

    It is estimated that the total number of records that will be obtained is approximately 25,000 records for each of the years, of which approximately 12,500 will relate to individuals.

    Data will be gathered in small batches from businesses. Experience indicates that each business, on average, will use fewer than 30 contractors during a year and make fewer than 10 payments to each contractor.

    5.3 Data quality

    Based on previous contractor payments data matching programs the ATO is confident that the data will be of high quality. The data being sought is extracted from invoices provided by the businesses that is captured and stored by them as part of their existing record keeping requirements and good business practices.

    Data will be transformed into a standardised format and validated to ensure it contains the required data elements prior to loading to ATO computer systems.

    5.4 Data integrity

    The ATO has a mature identity matching engine known as the Client Identification Compliance system (CIDC). This system provides a level of confidence of the integrity of the data being matched as the system utilises more than one identifier in the matching process. For example, where the Australian Business Number (ABN), name, address and phone number of an entity are available, all items are used in the identity matching process. Very high confidence matches will occur where all fields are matched.

    It is anticipated that some data will be matched at lower confidence levels where not all fields are matched or data is unavailable.

    Where administrative action is proposed, additional checks will take place to ensure the correct taxpayer has been identified. The taxpayer will be provided with the opportunity to verify the accuracy of the information before any administrative action is taken.

    5.5 Data security

    ATO staff are subject to the strict secrecy and privacy provisions contained in Division 355 of Schedule 1 to the Taxation Administration Act 1953 and include terms of imprisonment in cases of serious contravention of these provisions.

    All ATO computer systems are strictly controlled, with features including:

    • System access controls and security groupings.
    • Login identification codes and password protection.
    • Full audit trails of data files and system accesses.

    Data will be collected personally by employer obligations staff and may be collected in hard copy or electronic format. The data will be stored and transported in accordance with internal policies and guidelines that relate to all compliance activity documentation and information collection.

    6 Discrepancy matching

    6.1 Matching process

    The identity matching process is described above under ‘Data Integrity’ and is the first step in the matching process.

    Records with a sufficient confidence level in the identity match will be loaded onto another of the ATO’s secure computer systems where data analysts will use various techniques to identify potentially high risk discrepancy matches for actioning within compliance areas. Cases selected for administrative action will be loaded to our case management system for allocation to compliance staff.

    Lower risk discrepancy matches will be further analysed and a decision made to take some form of compliance or educational activity, or to destroy the data.

    6.2 Quality assurance

    Quality assurance processes are integrated into ATO processes and computer systems and are applied throughout the data matching cycle.

    These assurance processes include:

    • Registering the intention to undertake a data matching program on an ATO internal central register
    • Obtaining approvals from the Data Matching Gatekeeper and relevant Senior Executive Service (SES) officers prior to any activity being undertaken
    • Notifying OAIC of our intention to undertake the data matching program and request permission to vary from the Data Matching Guidelines
    • Maintaining access management logs recording details of who has access to the data, why access is required and how it will be used
    • Processes embedded into compliance activities, such as:
      • Review of risk assessments, taxpayer profiles and case plans by senior officers prior to client contact
      • On-going reviews of cases by subject matter technical experts at key points during the life cycle of a case
      • Regular independent panel reviews of samples of case work to provide assurance of the accuracy and consistency of case work.
       

    These processes ensure data is collected and used in accordance with the ATO’s data management policies and principles, and complies with the OAIC’s data matching guidelines.

    7 Previous program

    The ATO’s data matching program has been on-going since the 2008-09 financial year.

    This data is combined with other ATO data and used in various analytical models to identify appropriate cases for administrative action. It is difficult to directly attribute the number of cases identified for compliance action and the revenue raised and lodgments obtained solely to the data matching activities.

    8 Action resulting from the program

    The contractor payment data matching program will enable the ATO to identify contractors that may not be meeting their registration, lodgment, reporting or payment obligations and allows for:

    • Identification of suitable cases for compliance activity
    • Development of tailored products or services to assist taxpayers meet their obligations and provide certainty.

    Before any administrative action is taken, taxpayers will be provided with the opportunity to verify the accuracy of the information obtained by the ATO. Taxpayers will be given at least 28 days to respond before administrative action is taken.

    The data may also be used to ensure that taxpayers are complying with their other taxation and superannuation obligations, including registration requirements, lodgment obligations and payment responsibilities.

    In cases where taxpayers fail to comply with these obligations after being reminded of them, escalation for further action may be instigated in appropriate circumstances.

    Where a taxpayer has correctly met their obligations, the use of the data will reduce the likelihood of contact from the ATO.

    9 Time limits applying to the program

    The collection of data under this program protocol will be ongoing throughout the 2014-15, 2015-16 and 2016-17 financial years.

    The ATO is seeking to have the Privacy Commissioner exercise his discretion and allow the ATO to vary from the data destruction requirements contained in the Guidelines.

    The ATO is seeking to retain the data for a period of three years after it is collected on the basis that its retention is required for the protection of public revenue. Current guidelines allow for a 12 month retention. Destroying the data in the timeframes contained in the guidelines would hinder the ATO’s ability to protect public revenue. The data needs to be retained until the taxpayer has lodged their return and for a further period if subsequent compliance issues are identified within the period of review allowed by the law.

    A full case setting out the basis for seeking this variation to the Guidelines and its impacts on individual privacy is contained at Appendix A.

    10 Public notice of the program

    The ATO will publish a public notification of this data matching program in the Commonwealth government notices gazette in the week commencing 9 March 2015. A copy of the gazette notice will be provided to the data providers and the OAIC. A copy of the proposed gazette notice is included at Appendix B.

    The ATO will publish a copy of this data matching program protocol on its website once the Gazette Notice has been published. It can be accessed from:

    www.ato.gov.au/dmprotocols

    11 Relationship to lawful functions

    The Commissioner of Taxation has responsibility for ensuring taxpayers meet their taxation and superannuation obligations. Compliance with these obligations is a matter the ATO takes seriously and failure to address non-compliant behaviour has the potential to undermine community confidence in the integrity of the taxation and superannuation systems and the ATO’s capacity to administer those systems.

    The ATO’s data matching program is one of the strategies used to identify and deal with non-compliant behaviour. Data matching programs also provide a degree of assurance that taxpayers are meeting their obligations.

    12 Legal authority

    12.1 ATO legislation

    The data will be obtained under the ATO’s formal information gathering powers contained in the following legislative provisions:

    • Sections 263 & 264 of the Income Tax Assessment Act 1936
    • Sections 353-10 & 353-15 of Schedule 1 to the Taxation Administration Act 1953 (administering indirect taxes)
    • Sections 127 & 128 of the Fringe Benefits Tax Assessment Act 1986.

    These are coercive powers that oblige the data providers to furnish the information requested. The ATO will use the information for taxation and superannuation compliance purposes.

    12.2 Privacy Act

    Data will only be used within the limits prescribed on the use of personal information imposed by Australian Privacy Principle 6 (APP6) contained in Schedule 1 of the Privacy Act 1988 and in particular:

    • APP6.2(b) – the use of the information is permitted by an Australian Law; and
    • APP6.2(e) – the use is necessary for the ATO’s enforcement related activities.

    13 Alternative methods

    The ATO has considered a range of alternatives to this data matching program to ensure entities are complying with their taxation and superannuation obligations. Relying only on data already held by the ATO is of limited value for the following reasons:

    • The ATO only receives data from taxpayers that are correctly registered and meeting their lodgment obligations
    • The ATO has no other data to cross-reference to ensure taxpayers are reporting their obligations correctly other than by directly contacting every taxpayer.

    This data matching program will allow the ATO to identify taxpayers who are not fully complying with their obligations, as well as those that may be operating outside the taxation and superannuation systems. It will also reduce the likelihood of the ATO unnecessarily contacting taxpayers who appear to be complying with their taxation obligations.

    Data matching is an effective method of examining records of thousands of taxpayers to ensure compliance with lodgment and reporting obligations that would otherwise be a resource intensive exercise.

    It also assists the ATO in effectively promoting voluntary compliance by notifying the public of areas and activities under scrutiny, despite some negative perceptions toward data matching.

    14 Costs and benefits

    14.1 Costs

    There are incidental costs to the ATO to conduct this data matching program:

    • Data analyst resources to identify potential instances of non-compliance
    • Compliance resources to manage collection of data, casework and educational activities
    • Governance resources to ensure that the Guidelines and Privacy Act are complied with and quality assurance work to ensure the rigour of the work undertaken by analysts and compliance staff
    • Storage of the data.

    14.2 Benefits

    Benefits from conducting this data matching program include:

    • Maintaining community confidence in both the taxation and superannuation systems by creating a level playing field, as well as maintaining community confidence in the ATO’s capacity to fairly administer those systems
    • Integrity of the taxation and superannuation systems – there are inherent risks in taxpayers not complying with their obligations, including those that deliberately abuse these systems – this program will assist the ATO in detecting, dealing with and deterring those that are not meeting their obligations
    • Enabling enforcement activity and recovery of taxation revenue - without undertaking this data matching program and subsequent compliance activity there are no assurances that a wider risk to revenue does not exist.

    Appendix A – Variation to guidelines

    The Australian Taxation Office (ATO) is seeking approval for the contractor payments data matching program to vary from one or more of the conditions detailed in Guideline 10 of the Office of the Australian Information Commissioner’s Guidelines on data matching in Australian government administration (2014) (the Guidelines).

    The ATO is seeking to retain data for three years from receipt of all verified data files from data providers. The ATO considers that a variation from the usual retention period for this data matching program is in the public interest as:

    • At the time the data is collected the contractor may not be under an obligation to have lodged a return
    • Contractors may provide services to multiple businesses and the ATO must identity all payments made to a contractor
    • The law generally allows for the affairs of a taxpayer to be reviewed during a period of two to four years after a return is lodged.

    Destruction of the data within 12 months, as per current guidelines, would inhibit the ATO’s ability to identify taxpayers who may be subject to administrative action and therefore result in loss of public revenue.

    The ATO has determined that this variation will not affect the privacy of an individual or entity.

    This program will be subject to an evaluation within three years which is consistent with the requirements of Guideline 9.

    Additional information justifying this variation is included in the tables below:

    • Table 1 – Matters considered in accordance with Guideline 10.2 in seeking this variation
    • Table 2 – Consistency with requirements of the other Guidelines issued by the Office of the Australian Information Commissioner.

    The ATO does not require that this request be kept confidential (Guideline 10.6) and has no concern should the Office of the Australian Information Commissioner place this information on its website.

    Table 1 – Matters considered in seeking this variation to the guidelines

    Matter considered

    Consideration

    10.2.1 - The effect of not abiding by the specified requirements of the Guidelines would have on individual privacy

    • Retaining data for a period of three years will not increase the risk to an individual or entity’s privacy. The ATO has in place very secure processes for handling and storing data. Once acquired, all data will be stored on ATO secure computer systems where access is strictly controlled and full audit logs maintained.
    • The ATO and its staff operate under stringent secrecy and privacy legislation that prohibits the improper access to or disclosure of protected information. These obligations are supported by significant penalties, including imprisonment. This substantially mitigates the risks of breaches of privacy.
     

    10.2.2 - The seriousness of the administrative or enforcement action that may flow from the data matching program

    • An extension of the retention period will not affect the seriousness of the administrative action that may flow from the match, but will assist in detecting non-compliance or taxation fraud.
    • Where the ATO proposes to take administrative action where a taxpayer may have reported incorrectly, the ATO will differentiate between those that try to do the right thing and those that set out to deliberately avoid their obligations. Documented procedures, including the Taxpayers’ Charter and Compliance Model will be followed to ensure fairness and consistency.
     

    10.2.3 - The effect that not abiding by the specified requirements of the guidelines would have on the fairness of the program – including its effect on people’s ability to find out the basis for decisions that affect them and their ability to dispute those decisions

    • There will be no effect on the fairness of the program or the ability of taxpayers to find out the basis of decisions that impact them or their ability to dispute those decisions.
    • Before any administrative action is undertaken, taxpayers will be given at least 28 days to verify the accuracy of the information derived from this data matching program.
    • Where administrative action is to be undertaken, we will adhere to the principles established in the Taxpayers’ Charter and Compliance Model to ensure an equitable and consistent approach is taken.
    • If a taxpayer does not agree with an assessment, they maintain the right to dispute the decision. They also have the legal right to appeal against those decisions through the courts and tribunals.
     

    10.2.4 - The effect that not abiding by the specified requirements of the guidelines would have on the transparency and accountability of government operations

    • There will be no adverse effects on the transparency and accountability of government operations.
    • A program protocol is submitted to the Office of the Australian Information Commissioner and the ATO will strictly adhere to the commitments in that document
    • The ATO will publish a notice with general information about the program in the Commonwealth Government Notices Gazette before data matching commences. The ATO will also make a copy of the program protocol available on its website.
     

    10.2.5 - The effect that not abiding by the specified requirements of the guidelines would have on compliance of the proposed program with the Australian Privacy Principles in the Privacy Act 1988

    • There will be no effect on compliance with the Australian Privacy Principles contained in Schedule 1 to the Privacy Act 1988 due to longer retention of the data. The data collected is solely for the stated objectives established in the data matching program protocol.
     

    10.2.6 - The effect that abiding by all of the requirements of the guidelines would have on the effectiveness of the proposed program

    • The effectiveness of the program would be reduced if the data retention period is not extended.
    • There would be a significant reduction in the ability of the ATO to detect incorrect reporting and taxation fraud without understanding and monitoring trends in the data collected.
    • The destruction of the data in accordance with the current Guidelines would impact the integrity of the taxation system by:
      • Limiting the ATO’s ability to identify taxpayers who may be subject to administrative action.
      • Resulting in the loss of revenue.
       
     

    10.2.7 - Whether complying fully with the Guidelines could jeopardise or endanger the life or physical safety of information providers or could compromise the source of information provided in confidence

    • Not abiding by all requirements of the Guidelines would not influence or affect the personal safety of any individual identified as part of the program or compromise the source of the information provided in confidence.
     

    10.2.8 - The effect that abiding by all the requirements of the guidelines would have on public revenue – including tax revenue, personal benefit payments, debts to the Commonwealth and fraud against the Commonwealth

    • Not allowing the variation to the data retention period of the current program would cause the ATO to miss potential breaches of taxation laws and subsequent non-payment of tax. This would result in the Commonwealth foregoing taxation revenue.
    • There are risks to the integrity of taxation system when people fail to comply with their obligations. Abiding by all of the requirements of the Guidelines will reduce the effectiveness of proposed compliance activity. The ATO would miss the opportunity to educate those taxpayers trying to do the right thing and deterring those that are non-compliant from repeating the behaviour.
    • The effect of abiding by all of the requirements in the Guidelines could negatively impact on both public revenue and public and government confidence in the ATO. People not complying with their taxation obligations, including those operating outside the system, set a bad example to compliant taxpayers and may encourage their non-compliance. Maintaining community and government confidence in the taxation system is critical to the on-going role of the ATO.
     

    10.2.9 - Whether abiding by all of the requirements of the guidelines would involve the release of a document that would be an exempt document under the Freedom of Information Act 1982

    • Only information relating to the taxpayer’s own affairs will be released upon receipt of a freedom of information request.
     

    10.2.10 - The legal authority for conducting the proposed program in a way inconsistent with the specified requirements of the Guidelines

    • The legal authority for conducting the proposed program in a way inconsistent with the specified requirements of the guidelines
     

    Table 2 – Consistency with the guidelines

    This section outlines where the ATO is consistent with the requirements of the Office of the Australian Information Commissioner’s Guidelines on data matching in Australian government administration (2014).

    Paragraph/Guideline

    Action taken/to be taken

    Paragraph 6

    Status of the guidelines

    The ATO has committed to comply with the Office of the Australian Information Commissioner’s Guidelines on data matching in Australian government administration (2014) by way of a Chief Executive instruction.

    Guideline 1

    Application of the guide

    The ATO applies the Guidelines for all data matching programs where it is anticipated the program will include records of 5,000 or more individuals or entities.

    The ATO recognises that programs with multiple data sources but common objectives and algorithms, are treated as a single data matching program.

    Guideline 2

    Considerations before conducting a data matching program

    The ATO conducts a cost-benefit analysis and considers alternate methods prior to proposing to conduct a data matching program.

    Further, the ATO has rigorous governance arrangements, processes and system controls in place to protect the privacy of individuals.

    Guideline 3

    Prepare a program protocol

    Prior to conducting a data matching program, the ATO prepares a data matching program protocol, submits this to the Office of the Australian Information Commissioner and makes a copy publicly available on the ATO website.

    When elements of a data matching program change, the protocol is amended and a copy of the amended protocol provided to the Office of the Australian Information Commissioner. It is also republished on the ATO web site.

    Guideline 4

    Technical standards report

    Documentation is prepared and maintained so as to satisfy requirements of a Technical Standards Report.

    Guideline 5

    Notify the public

    The ATO publishes notification of its intention to undertake a data matching program in the Commonwealth government gazette notices prior to the commencement of the program.

    This notice includes all of the requirements outlined in the guidelines.

    Notification of the program is also published on the ATO’s website and data providers are advised they can advertise their participation in the data matching program.

    Guideline 6

    Notify individuals of proposed administrative action

    Prior to taking any administrative action as a result of the data matching program individuals and other entities are given at least 28 days to verify the accuracy of the information provided to the ATO by third parties.

    Guideline 7

    Destroy information that is no longer required

    The ATO is seeking to vary from this requirement.

    Guideline 8

    Do not create new registers, datasets or databases

    The ATO does not create new registers or databases using data obtained in the course of a data matching program.

    Guideline 9

    Data matching program evaluations

    Programs are regularly evaluated within 3 years of the commencement of the data matching program. These evaluations are provided to the Office of the Australian Information Commissioner.

    Guideline 10

    Variations to guideline requirements

    When the ATO intends to vary from the requirements of the Guidelines it seeks the approval of the Office of the Australian Information Commissioner and provides documentation to support the variance.

    Guideline 11

    Data matching with entities other than agencies

    The ATO undertakes its own data matching programs.

    The ATO does not outsource this function.

    Where data is obtained from an entity other than an individual, the ATO usually does so using its formal information gathering powers. In these instances the entities are advised they are able to notify their clients of their participation in the data matching program.

    Guideline 12

    Data matching with exempt agencies

    The ATO does not usually undertake data matching with agencies that are exempt from the operations of the Privacy Act 1988 under section 7 of that Act and that are subject to the operation of the Guidelines (i.e. any data matching undertaken with an exempt agency would usually be for fewer than 5,000 individuals).

    In the event a data matching activity would otherwise be subject to these Guidelines except for the exemption status, the ATO would still adhere to the principles of the Guidelines and prepare a program protocol, seeking to vary from the Guidelines by not publicly notifying of the program and publishing the protocol. The ATO would still lodge a copy of the Protocol with the Office of the Australian Information Commissioner.

    Guideline 13

    Enable review by the Office of the Australian Information Commissioner

    The ATO would not prevent the Office of the Australian Information Commissioner from reviewing its data matching activities and processes. These activities and processes have been reviewed by the Australian National Audit Office and Inspector-General of Taxation.

    Appendix B – Gazette notice

    Commissioner of Taxation

    NOTICE OF A DATA MATCHING PROGRAM

    The Australian Taxation Office (ATO) will continue to acquire details of entities that receive contractor payments from other businesses for the 2013-14, 2014-15 and 2015-16 financial years. This is the continuation of an ongoing program where data is to be collected from taxpayers that we come in contact with through our normal compliance program activities.

    The data items that will be obtained are:

    • Australian Business Number (ABN) of the payer business
    • ABN of the payee business (contractor)
    • Name of the contractor
    • Address of the contractor
    • Telephone details of the contract
    • Dates of payments to the contractors
    • Amounts paid the contractor (including details of whether the payment included GST)

    It is estimated that records for approximately 25,000 entities will be obtained each year, including the records for approximately 12,500 individuals.

    These records will be electronically matched with certain sections of ATO data holdings to identify non-compliance with registration, lodgment, reporting and payment obligations under taxation laws.

    The purpose of this data matching program is to ensure that taxpayers are correctly meeting their taxation obligations in relation to contractor payments. These obligations include registration, lodgment, reporting and payment responsibilities.

    Objectives of the contractor payments data matching program:

    • Identify and address contractors that may not be meeting their taxation obligations, including registration, lodgment and reporting
    • Verify the integrity of the information held on the Australian Business Register to assist the Registrar develop educational and compliance strategies
    • Obtain intelligence to identify risks and trends about contractors that may not be complying with their taxation obligations
    • Better tailor educational products and services to address identified areas of concern and give more certainty to taxpayers in managing their obligations
    • Promote voluntary compliance and strengthen community confidence in the integrity of the tax system.

    A document describing this program has been prepared in consultation with the Office of the Australian Information Commissioner. A copy of this document is available:

    The ATO complies with the Office of the Australian Information Commissioner’s Guidelines on data matching in Australian government administration (2014) which includes standards for data matching to protect the privacy of individuals. A full copy of the ATO’s privacy policy can be accessed at www.ato.gov.au/privacy

      Last modified: 11 Mar 2015QC 44473